Overview
overview
10Static
static
10DcRat.exe
windows10-2004-x64
10Plugins/Audio.dll
windows10-2004-x64
1Plugins/Chat.dll
windows10-2004-x64
1Plugins/Discord.dll
windows10-2004-x64
1Plugins/Extra.dll
windows10-2004-x64
1Plugins/Fi...er.dll
windows10-2004-x64
1Plugins/Fi...er.dll
windows10-2004-x64
1Plugins/Fun.dll
windows10-2004-x64
1Plugins/In...on.dll
windows10-2004-x64
1Plugins/Keylogger.exe
windows10-2004-x64
1Plugins/Logger.dll
windows10-2004-x64
1Plugins/Me...ib.dll
windows10-2004-x64
1Plugins/Mi...us.dll
windows10-2004-x64
1Plugins/Netstat.dll
windows10-2004-x64
1Plugins/Options.dll
windows10-2004-x64
1Plugins/Pr...er.dll
windows10-2004-x64
1Plugins/Ra...re.dll
windows10-2004-x64
1Plugins/Recovery.dll
windows10-2004-x64
1Plugins/Regedit.dll
windows10-2004-x64
1Plugins/Re...ra.dll
windows10-2004-x64
1Plugins/Re...op.dll
windows10-2004-x64
1Plugins/Re...xy.dll
windows10-2004-x64
1Plugins/SendFile.dll
windows10-2004-x64
1Plugins/Se...ry.dll
windows10-2004-x64
1Stub/Client.exe
windows10-2004-x64
10Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
20/07/2024, 09:53
Behavioral task
behavioral1
Sample
DcRat.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
Plugins/Audio.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Plugins/Chat.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
Plugins/Discord.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Plugins/Extra.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
Plugins/FileManager.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Plugins/FileSearcher.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral8
Sample
Plugins/Fun.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Plugins/Information.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
Plugins/Keylogger.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Plugins/Logger.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
Plugins/MessagePackLib.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Plugins/Miscellaneous.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
Plugins/Netstat.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Plugins/Options.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
Plugins/ProcessManager.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Plugins/Ransomware.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
Plugins/Recovery.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Plugins/Regedit.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
Plugins/RemoteCamera.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Plugins/RemoteDesktop.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
Plugins/ReverseProxy.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Plugins/SendFile.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
Plugins/SendMemory.dll
Resource
win10v2004-20240709-en
General
- Target Plugins/Keylogger.exe
- Size 10KB
- Sample240720-lwt3cswhpl
- SHA256 85c1c0070b0bbe577cce521a39a4943e97120957fb5b69b0c0b913bbdc7f2f8c
- MD5 bb705e1212af49881a31f2de2bc48653
- SHA1 a9728d5a995b163d6d4c590b3d79836b469806f7
- SHA512 9526b5279478e01c37ed001cd7bc69a3583cc5ce4a7c9ac0e404a1d8b554878513abe3c282eda81f8c524bbbbe84e7ec66ecee22ca62e88dc8962aed58662aed
- SSDEEP 192:Htmcuq6MYDxi4maEYbRzmEsLkTgv5JHTUeJYHcwY7fazJFEi:HtlF6MWE9rUhVsL15pUrYyVFE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4720 Keylogger.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4720 Keylogger.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4720 Keylogger.exe